CVE-2026-35349: uutils coreutils has a Link Following Issue Via rm Utility

April 22, 2026 (updated April 29, 2026)

A vulnerability in the rm utility of uutils coreutils allows a bypass of the –preserve-root protection. The implementation uses a path-string check rather than comparing device and inode numbers to identify the root directory. An attacker or accidental user can bypass this safeguard by using a symbolic link that resolves to the root directory (e.g., /tmp/rootlink -> /), potentially leading to the unintended recursive deletion of the entire root filesystem.

References

github.com/advisories/GHSA-v762-x3cf-5mfg
github.com/uutils/coreutils/commit/5e5968cdbc6618acd6c2402a8a98b503f278835e
github.com/uutils/coreutils/pull/9706
github.com/uutils/coreutils/releases/tag/0.7.0
nvd.nist.gov/vuln/detail/CVE-2026-35349

Code Behaviors & Features

Detect and mitigate CVE-2026-35349 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →